Skip to content

chore: update release.yml#4334

Merged
Wauplin merged 1 commit into
mainfrom
security-fix/-github-workflows-release-yml-1781088958
Jun 10, 2026
Merged

chore: update release.yml#4334
Wauplin merged 1 commit into
mainfrom
security-fix/-github-workflows-release-yml-1781088958

Conversation

@hf-security-analysis

@hf-security-analysis hf-security-analysis Bot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Update .github/workflows/release.yml workflow configuration.

cc @dependabot[bot] @hanouticelina

Closes huggingface/tracking-issues#816


Note

Low Risk
CI-only refactor with no change to release versioning, publishing, or secrets handling; Slack notification inputs are equivalent.

Overview
Refactors the Notify Slack — release started step in release.yml so release metadata is supplied through the step env block instead of shell assignments at the top of the run script.

VERSION, TAG, BRANCH, RELEASE_TYPE, and RUN_URL now come from ${{ steps.version.outputs.* }}, ${{ inputs.release_type }}, and the workflow run URL. The case on RELEASE_TYPE uses "${RELEASE_TYPE}" for consistent quoting. Slack message content and behavior should be unchanged.

Reviewed by Cursor Bugbot for commit 7f81d5f. Bugbot is set up for automated code reviews on this repo. Configure here.

@hf-security-analysis hf-security-analysis Bot requested a review from paulinebm June 10, 2026 10:56
@bot-ci-comment

Copy link
Copy Markdown

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

@Wauplin Wauplin left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@Wauplin Wauplin merged commit 27340ca into main Jun 10, 2026
22 of 26 checks passed
@Wauplin Wauplin deleted the security-fix/-github-workflows-release-yml-1781088958 branch June 10, 2026 11:51
@huggingface-hub-bot

Copy link
Copy Markdown
Contributor

This PR has been shipped as part of the v1.19.0 release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants